Travelling to Indonesia? Beware of fake qr codes and online payment scams
Scammers may replace or cover legitimate merchant QR codes with fraudulent ones, potentially redirecting payments or stealing financial information
- Nov 4, 2026,
- Updated Nov 4, 2026 1:40 AM IST
Indian travellers planning trips to Indonesia have been warned to remain vigilant against cyberthreats, including fraudulent payment links, phishing websites and malicious QR codes. Cybersecurity firm Kaspersky has highlighted the risks faced by tourists as they use digital services for bookings, payments and travel planning.
According to Kaspersky data, users in Indonesia encountered 12,926,883 general web threat detections between the third quarter of 2025 and the second quarter of 2026. The findings underline the importance of digital safety for visitors relying on online platforms and public networks while travelling.
During the same period, Kaspersky recorded 559,924 password stealer detections, 481,008 spyware detections and 2,847,403 backdoor detections. Password stealers are designed to collect login credentials, while spyware can monitor user activity and access sensitive information. Backdoors may allow attackers to gain unauthorised access to infected devices.
READ THIS: iPhone Duo scam alert: How scammers are tricking premium smartphone buyers
Fraudulent QR codes pose a major risk
Kaspersky’s Global Research and Analysis Team (GReAT) has identified fraud targeting Indonesia’s QRIS payment system as a key cybersecurity concern for tourists. QRIS is Indonesia’s national QR payment system, widely accepted by shops, restaurants and vendors.
Scammers may replace or cover legitimate merchant QR codes with fraudulent ones, potentially redirecting payments or stealing financial information. Travellers are advised to verify merchant details before confirming transactions and check whether QR codes have been tampered with.
Kaspersky also recommends checking website addresses before entering payment details and keeping transaction notifications enabled to identify suspicious payments quickly.
“Travel is a time when people naturally focus on discovering new places, not on cybersecurity. This is exactly what makes tourists attractive targets,” said Noushin Shabab, Lead Security Researcher at Kaspersky’s GReAT.
She added that cybercriminals exploit unfamiliar digital services, new locations and the quick decisions travellers often make. Understanding destination-specific threats can help tourists protect their data, she said.
ALSO READ: New Zealand eases visa rules to attract foreign experts and global businesses. Who benefits?
How travellers can protect themselves
Kaspersky advises tourists to book flights, accommodation and transport directly through official websites or applications rather than clicking links received through emails, text messages or social media.
Travellers should use strong, unique passwords, enable multi-factor authentication and download applications only from official app stores. They should also be cautious of deals that appear too good to be true, particularly those demanding urgent payments through unusual methods.
For public Wi-Fi, travellers should consider using a virtual private network (VPN) to encrypt their internet connection. Kaspersky also recommends checking bank and card statements after bookings and reporting unrecognised transactions immediately.
Indian travellers planning trips to Indonesia have been warned to remain vigilant against cyberthreats, including fraudulent payment links, phishing websites and malicious QR codes. Cybersecurity firm Kaspersky has highlighted the risks faced by tourists as they use digital services for bookings, payments and travel planning.
According to Kaspersky data, users in Indonesia encountered 12,926,883 general web threat detections between the third quarter of 2025 and the second quarter of 2026. The findings underline the importance of digital safety for visitors relying on online platforms and public networks while travelling.
During the same period, Kaspersky recorded 559,924 password stealer detections, 481,008 spyware detections and 2,847,403 backdoor detections. Password stealers are designed to collect login credentials, while spyware can monitor user activity and access sensitive information. Backdoors may allow attackers to gain unauthorised access to infected devices.
READ THIS: iPhone Duo scam alert: How scammers are tricking premium smartphone buyers
Fraudulent QR codes pose a major risk
Kaspersky’s Global Research and Analysis Team (GReAT) has identified fraud targeting Indonesia’s QRIS payment system as a key cybersecurity concern for tourists. QRIS is Indonesia’s national QR payment system, widely accepted by shops, restaurants and vendors.
Scammers may replace or cover legitimate merchant QR codes with fraudulent ones, potentially redirecting payments or stealing financial information. Travellers are advised to verify merchant details before confirming transactions and check whether QR codes have been tampered with.
Kaspersky also recommends checking website addresses before entering payment details and keeping transaction notifications enabled to identify suspicious payments quickly.
“Travel is a time when people naturally focus on discovering new places, not on cybersecurity. This is exactly what makes tourists attractive targets,” said Noushin Shabab, Lead Security Researcher at Kaspersky’s GReAT.
She added that cybercriminals exploit unfamiliar digital services, new locations and the quick decisions travellers often make. Understanding destination-specific threats can help tourists protect their data, she said.
ALSO READ: New Zealand eases visa rules to attract foreign experts and global businesses. Who benefits?
How travellers can protect themselves
Kaspersky advises tourists to book flights, accommodation and transport directly through official websites or applications rather than clicking links received through emails, text messages or social media.
Travellers should use strong, unique passwords, enable multi-factor authentication and download applications only from official app stores. They should also be cautious of deals that appear too good to be true, particularly those demanding urgent payments through unusual methods.
For public Wi-Fi, travellers should consider using a virtual private network (VPN) to encrypt their internet connection. Kaspersky also recommends checking bank and card statements after bookings and reporting unrecognised transactions immediately.